Differential Power Analysis Research Articles

Evaluating and Improving Linear Regression Based Profiling: On the Selection of Its Regularization

Side-channel attacks (SCAs) play an important role in the security evaluation of cryptographic devices. As a form of SCAs, profiled differential power analysis (DPA) is among the most powerful and efficient by taking advantage of a profiling phase that learns features from a controlled device. Linear regression (LR) based profiling, a special profiling method proposed by Schindler et al., could be extended to generic-emulating DPA (differential power analysis) by on-the-fly profiling. The formal extension was proposed by Whitnall et al. named SLR-based method. Later, to improve SLR-based method, Wang et al. introduced a method based on ridge regression. However, the constant format of L-2 penalty still limits the performance of profiling. In this paper, we generalize the ridge-based method and propose a new strategy of using variable regularization. We then analyze from a theoretical point of view why we should not use constant penalty format for all cases. Roughly speaking, our work reveals the underlying mechanism of how different formats affect the profiling process in the context of side channel. Therefore, by selecting a proper regularization, we could push the limits of LR-based profiling. Finally, we conduct simulation-based and practical experiments to confirm our analysis. Specifically, the results of our practical experiments show that the proper formats of regularization are different among real devices.

Cryptography with Analog Scheme Using Memristors

Networks of low-power Internet of Things do not have always access to enough computing power to support mainstream cryptographic schemes; such schemes also consume computing power that can be exposed to side channel attacks. This article describes a method, that we call “cryptography with analog scheme using memristors,” leveraging the physical properties of memristors, which are active elements suitable for the design of components such as artificial neurons. The proposed devices encrypt messages by segmenting them into blocks of bits, each modulating the injected currents into randomly selected memristor cells, resulting into sets of resistance values turned into cipher texts. Through hash-protected handshakes, identical addresses are independently generated by both communicating devices, to concurrently point at the same set of cells in the arrays, and their images. These block ciphers, for example, 1 KB long, can only be decrypted with the same memristor array driven by analog circuitry or its image, rather than digital key-based schemes. The proposed methods generate cipher text, and decrypt them, with approximately one femto joule per bit, which is below observable level through differential power analysis. The article explains how the use of different cells for each message to encrypt, driven under different conditions, has the potential to mitigate mainstream attacks. It provides a detailed characterization of memristors to evaluate the feasibility of the approach and discusses some hardware and architectures to implement the scheme.

Secure Path Balanced BDD-Based Pre-Charge Logic for Masking

This work presents a novel path balanced masked dual-rail pre-charge circuit design scheme based on binary decision diagrams (BDD), using one mask bit per output. It has been applied for achieving masked implementations of two common lightweight ciphers, namely Present and Lucifer. BDD based logic design is achieved using the CUDD tool and applying suitable variable reordering techniques. Path balancing has helped to counter the early propagation effect (EPE) to achieve a glitch free circuit design. Non-linear shift register has been used to generate the mask bits to avoid prediction of the mask bit, even if those should be occasionally uncovered. The design has been evaluated on many aspects such as glitch attack resistance, correlation / differential power analysis attack resistance, peak power variance, etc. and found to have satisfactory circuit performance while being highly robust to side channel attacks.

Resisting HODPA attacks in modular exponentiation using inner product with differential evolution

This paper presents a secured computation of modular exponentiation to resist higher-order differential power analysis (HODPA) attacks in asymmetric cryptosystems like RSA. HODPA attacks can be resisted by segmenting secret sensitive data and its intermediate values into multiple shares. In modular exponentiation-based cryptosystems, the exponent plays a significant part in the secret key. We have used inner product with differential evolution algorithm to segment the exponent into multiple shares. Using entropy-based nearest neighbor algorithm, we have randomly computed independent modular exponentiation to resist SPA and DPA attacks. Analysis was done on 1024, 1536 and 2048 bit RSA. With a pre-computation complexity, the proposed approach can provide significant resistance to SPA, DPA and HODPA attacks against modular exponentiation-based cryptosystems.

Efficient Register Renaming Architectures for 8-bit AES Datapath at 0.55 pJ/bit in 16-nm FinFET

Small-footprint implementations of the advanced encryption standard (AES) algorithm are of interest in resource-constrained applications like Internet of Things (IoT). Symmetries in AES allow the datapath to be scaled down to the S-Box width of 8 bits, but the ShiftRows operation leads to a potential data hazard that must be avoided. The common method for resolving the ShiftRows hazard wastes power by moving data through a sequence of pipelined registers. We present in this article a novel 8-bit AES architecture that solves data movement inefficiencies by renaming registers and saves clock power with a single state update per AES round. We then extend register renaming to include microarchitectural randomization to mitigate susceptibility to side-channel attacks, which are a concern especially for low power implementations of AES. We fabricate and evaluate our designs in a commercial 16-nm FinFET technology. Testchip measurements show that the register renaming architecture encrypts data at 0.55 pJ/bit at nominal voltage, a $2.2\times $ improvement over a state-of-the-art reference 8-bit design implemented in the same technology. Side-channel evaluation indicates that the randomized variant of register renaming significantly reduces vulnerability to differential power analysis (DPA).

Low area overhead DPA countermeasure exploiting tunnel transistor‐based random number generator

Differential power analysis (DPA) has become an efficient side channel attack that obtains a secret key from the extracted power traces. Several traditional CMOS-based DPA countermeasures resulted in high area overhead and performance degradation. This study presents low area overhead DPA countermeasure exploring tunnel field effect transistors (TFET) based random number generator (RNG). TFET exhibits significant p–i–n forward current with an increase in negative drain-to-source voltage bias. It is demonstrated that TFET transmission gate exhibits unconventional behaviour due to p–i–n forward current of the device. Leveraging this behaviour TFET RNG is designed that extracts random bits from delay variations of the TFET ring oscillator. The proposed TFET RNG achieves low area overhead when compared with the baseline CMOS designs. The proposed DPA countermeasure is demonstrated by integrating the original TFET substitution box (S-box) and TFET RNG. The proposed architecture is found to be resilient to DPA attack and the area overhead of single S-box and Advanced Encryption Standard AES is as low as 12 and 5%, respectively. Apart from low area overhead, the TFET designs with inherent device characteristics show high robustness against reverse engineering attacks which provide a higher level of security to TFET-based circuits and systems.

ReCoFused partial reconfiguration for secure moving-target countermeasures on FPGAs

Partial reconfiguration is a versatile technique to modify the functionality of field programmable gate arrays (FPGAs) at run time. When performing partial reconfiguration a dedicated intellectual property (IP) component of the FPGA vendor, i.e., the partial reconfiguration controller (PRC), among a wide range of IP components has to be used. While ensuring the functional safety of FPGA designs is well understood, ensuring hardware security still remains challenging. This applies in particular to reconfiguration-based countermeasures which are intensively used to create a moving target for an attacker. Reconfiguration-based countermeasures against side-channel attacks or differential power analysis (DPA) attacks were implemented. However, from the system security perspective, the above mentioned PRC is a critical component as was noticed by many papers before. In this work, we extend a previously proposed safety mechanism which creates a container around an IP, to encapsulate and thereby to protect and observe the PRC of a FPGA. The proposed encapsulation scheme results in an architecture comprising so-called ReCoFuses (RCFs), each capturing a specific protective goal which have to be fulfilled at any time during PRC operation. The terminology follows the classical electric installation including a fuse box. In our scheme we employ formal verification to guarantee the correctness in detecting a security violation. Only after successful verification, the RCFs are integrated into the ReCoFuse Container. Experimental results demonstrate the advantage of our approach by preventing attacks on the PRC of a system secured by partial reconfiguration.

The Design of Compact SM4 Encryption and Decryption Circuits That Are Resistant to Bypass Attack

In order to achieve the purpose of defending against side channel attacks, a compact SM4 circuit was designed based on the mask and random delay technique, and the linear transformation module was designed with random insertion of the pseudo operation method. By analyzing the glitch data generated by the S-box of SM4 with different inputs, the security against glitch attacks was confirmed. Then, the DPA (Differential Power Analysis) was performed on the designed circuit. The key could not be successfully obtained even in the case of 100,000 power curves, so that the safety of SM4 against DPA is verified. Finally, using Synopsys DC (Design Compiler, Mountain View, CA94043DC, USA) to synthesize the designed circuit, the results show that the area of the designed circuit in the SMIC 0.18 process is 82,734 μm2, which is 48% smaller than results reported in other papers.

The Notion of Transparency Order, Revisited

Abstract We revisit the definition of transparency order (TO) and that of modified transparency order (MTO) as well, which were proposed to measure the resistance of substitution boxes (S-boxes) against differential power analysis (DPA). We spot a definitional flaw in original TO, which is proved to significantly affect the soundness of TO. Regretfully, MTO overlooks this flaw, yet it happens to incur no bad effects on the correctness of MTO, even though the start point of this formulation is highly questionable. It is also this neglect that made MTO consider a variant of multi-bit DPA attack, which was mistakenly thought to appropriately serve as an alternative powerful attack. This implies the soundness of MTO is also more or less arguable. Therefore, we fix this definitional flaw and provide a revised definition named reVisited TO (VTO). For demonstrating validity and soundness of VTO, we present simulated and practical DPA attacks on implementations of $4\times 4$ and $8\times 8$ S-boxes. In addition, we also illustrate the soundness of VTO in masked S-boxes. Furthermore, as a concrete application of VTO, we present the distribution of VTO values of optimal affine equivalence classes of $4\times 4$ S-boxes and give some recommended guidelines on how to select $4\times 4$ S-boxes with higher DPA resistance at the identical level of implementation cost.

Compact Code-Based Signature for Reconfigurable Devices With Side Channel Resilience

In this paper, we present a compact design for the code based signature called LEDAsig with side channel resistance. Existing implementations concentrate on the high-speed feature while few of them have considerations on area or power efficiency which are particularly decisive for low-cost or power constrained IoT applications. We propose an area-efficient FPGA architecture for systematically rotating the QC-LDGM codes amongst the block RAMs with read-first mode. Additionally, the side channel vulnerability of LEDAsig is carefully examined, and protective masking schemes are introduced accordingly to safeguard our design from power analysis attacks. Effectiveness of these schemes is verified on SAKURA-G FPGA board. Up till now, the design presented in this work is the most compact one and also the first side-channel secure one addressing first-order and (univariate) second-order differential power analysis for the code based signature schemes in the open literature. We show for instance that our first-order (second-order) protected implementation can sign a signature in 117 (203) ms on a Xilinx Spartan-6 FPGA, occupying only 622 (1142) slices, and therefore is a prospective candidate for post-quantum signature schemes in low-resource settings.

High-Speed Masking for Polynomial Comparison in Lattice-based KEMs

With the NIST post-quantum standardization competition entering the second round, the interest in practical implementation results of the remaining NIST candidates is steadily growing. Especially implementations on embedded devices are often not protected against side-channel attacks, such as differential power analysis. In this regard, the application of countermeasures against side-channel attacks to candidates of the NIST standardization process is still an understudied topic. Our work aims to contribute to the NIST competition by enabling a more realistic judgment of the overhead cost introduced by side-channel countermeasures that are applied to lattice-based KEMs that achieve CCA-security based on the Fujisaki-Okamoto transform. We present a novel higher-order masking scheme that enables an efficient comparison of polynomials as previous techniques based on arithmetic-to-Boolean conversions renders this (generally inexpensive) component extremely expensive in the masked case. Our approach has linear complexity in the number of shares compared to quadratic complexity of previous contributions and it applies to lattice based schemes with prime modulus. It comes with a proof in the probing model and an efficient implementation on an ARM Cortex-M4F microcontroller which was defined as a preferred evaluation platform for embedded implementations by NIST. Our algorithm can be executed in only 1.5-2.2 milliseconds on the target platform (depending on the masking order) and is therefore well suited even for lightweight applications. While in previous work, practical side-channel experiments were conducted using only 5,000 - 100,000 power traces, we confirm the absence of first-order leakage in this work by collecting 1 million power traces and applying the t-test methodology.

Design and verification of improved CMERE against power analysis attacks

ABSTRACT The CMERE algorithm was designed to resist DPA attacks on modular exponentiation. It was implemented and tested at the algorithmic level for different key sizes of the RSA cryptosystems. The strength of CMERE lied on the facts that it could be implemented both on left-to-right and right-to-left binary methods for modular exponentiation without any changes in the original algorithm. Also, the execution of modular exponentiation was completely bit independent making it a very strong countermeasure against simple and differential power analysis attacks. In this paper, we have verified the CMERE algorithm at hardware level using VHDL. During formal verification with VHDL on FPGA, the algorithm was modified for practical implementation. However, the overall strength of the improved CMERE algorithm remains the same as the original algorithm.

Enhancing Side Channel Attack-Resistance of the STTL Combining Multi-Vt Transistors with Capacitance and Current Paths Counterbalancing

Differential power analysis (DPA) exploits the difference between the instantaneous power of the circuit arches transitions to stole the state as information aiming to unveil the cryptographic key. Secure triple track logic (STTL) is a circuit-level countermeasure to DPA attacks based on dual-rail precharge logic (DPL). STTL is robust to attacks due to the delay in an insensitive feature that mitigates the logic glitches generated by the different path delays that lead to the logic gate inputs until they stabilize. The main STTL drawback, however, is the asymmetry of the transistor topology. Asymmetry causes unbalanced internal capacitances and different internal paths for the current flow, and DPA exploits it as a source of information leakage. Our work proposes three circuit topologies, combining multi-Vt transistors with a circuit counterbalancing strategy, aiming to improve the STTL DPA attack-resistance. Data encryption standard substitution-box circuit, designed in a TSMC 40 nm CMOS process, is our application case study to evaluate the DPA attack-resistance. Results gathered at the application-level show that our proposals outperform DPA attack-resistance of the prior work.

Power Side-Channel Attack Analysis: A Review of 20 Years of Study for the Layman

Physical cryptographic implementations are vulnerable to so-called side-channel attacks, in which sensitive information can be recovered by analyzing physical phenomena of a device during operation. In this survey, we trace the development of power side-channel analysis of cryptographic implementations over the last twenty years. We provide a foundation by exploring, in depth, several concepts, such as Simple Power Analysis (SPA), Differential Power Analysis (DPA), Template Attacks (TA), Correlation Power Analysis (CPA), Mutual Information Analysis (MIA), and Test Vector Leakage Assessment (TVLA), as well as the theories that underpin them. Our introduction, review, presentation, and survey of topics are provided for the “non expert”, and are ideal for new researchers entering this field. We conclude the work with a brief introduction to the use of test statistics (specifically Welch’s t-test and Pearson’s chi-squared test) as a measure of confidence that a device is leaking secrets through a side-channel and issue a challenge for further exploration.

Projection of Dual-Rail DPA Countermeasures in Future FinFET and Emerging TFET Technologies

The design of near future cryptocircuits will require greater performance characteristics in order to be implemented in devices with very limited resources for secure applications. Considering the security against differential power side-channel attacks (DPA), explorations of different implementations of dual-precharge logic gates with advanced and emerging technologies, using nanometric FinFET and Tunnel FET transistors, are proposed aiming to maintain or even improve the security levels obtained by current Metal-Oxide Semiconductor Field-Effect Transistor (MOSFET) technologies and reducing the resources needed for the implementations. As case study, dual-precharge logic primitives have been designed and included in the 4-bit substitution box of PRIDE algorithm, measuring the performance and evaluating the security through simulation-based Differential Power Analysis (DPA) attacks for each implementation. Extensive electrical simulations with predictive Predictive Transistor model on scaled 16nm and 22nm MOSFET, 16nm and 20nm FinFET, and 20nm Tunnel Field Effect Transistor (TFET) demonstrate a clear evolution of security and performances with respect to current 90nm MOSFET implementations, providing FinFET as fastest solutions with a delay 3.7 times better than conventional proposals, but TFET being the best candidate for future cryptocircuits in terms of average power consumption (x0.02 times compared with conventional technologies) and security in some orders of magnitude.

Side-Channel Power Resistance for Encryption Algorithms Using Implementation Diversity

This paper investigates countermeasures to side-channel attacks. A dynamic partial reconfiguration (DPR) method is proposed for field programmable gate arrays (FPGAs)s to make techniques such as differential power analysis (DPA) and correlation power analysis (CPA) difficult and ineffective. We call the technique side-channel power resistance for encryption algorithms using DPR, or SPREAD. SPREAD is designed to reduce cryptographic key related signal correlations in power supply transients by changing components of the hardware implementation on-the-fly using DPR. Replicated primitives within the advanced encryption standard (AES) algorithm, in particular, the substitution-box (SBOX)s, are synthesized to multiple and distinct gate-level implementations. The different implementations change the delay characteristics of the SBOXs, reducing correlations in the power traces, which, in turn, increases the difficulty of side-channel attacks. The effectiveness of the proposed countermeasures depends greatly on this principle; therefore, the focus of this paper is on the evaluation of implementation diversity techniques.

A Method for Scalar Multiplication on Elliptic Curves against Differential Power Analysis using Efficient Key-Randomization

A Method for Scalar Multiplication on Elliptic Curves against Differential Power Analysis using Efficient Key-Randomization

ECC Atomic Block with NAF against Strong Side-Channel Attacks on Binary Curves

Various side-channel attacks against elliptic curve cryptography (ECC) have been proposed so far, including simple power analysis, horizontal collision correlation analysis, improving the Big Mac attack, and differential power analysis. Developing countermeasures against such attacks is considered as an important research task in cryptography. They are executed by analyzing power consumption while a device implemented in a cryptosystem performs cryptographic processing. To address this problem, we propose using three atomic blocks serving as the countermeasures against such attacks on ECC over finite fields of characteristic two. Two of them are basic atomic blocks, while the third one is an improved version of these two, having lower computational cost. In this paper, concerning the possibility of more sophisticated side-channel attacks appearing in the future, we propose a threat model based on the atomic blocks that is constructed to be secure for strong side-channel attacks with more powerful abilities.

An Energy Trace Compression Method for Differential Power Analysis Attack

Differential power analysis attacks are the most commonly used means to break cryptographic devices within the side-channel attack technology. Since there is a lot of noise in the energy trace of cryptographic devices, a large number of energy traces are needed to carry out the attack, resulting in a high computational cost. To solve this problem, this study starts with an analysis of the characteristics of power waveform formation from the inherent properties of the complementary metal oxide semiconductor circuit. Then, based on the Hamming distance classification method and the results of power waveform analysis, the useful information interval in the energy trace is located, that is, the interval with a strong correlation with the key. Thus, we achieve energy trace compression. Finally, a system on chip with a 128-bit AES algorithm is used to conduct various attack experiments in the effective interval. The results show that the calculation is cut off by 96%, which greatly reduces the computational cost for differential power analysis attacks.

Improvement on a Masked White-Box Cryptographic Implementation

White-box cryptography is a software technique to protect secret keys of cryptographic algorithms from attackers who have access to memory. By adapting techniques of differential power analysis to computation traces consisting of runtime information, Differential Computation Analysis (DCA) has recovered the secret keys from white-box cryptographic implementations. In order to thwart DCA, a masked white-box implementation was suggested. It was a customized masking technique that randomizes all the values in the lookup tables with different masks. However, the round output was only permuted by byte encodings, not protected by masking. This is the main reason behind the success of DCA variants on the masked white-box implementation. In this paper, we improve the masked white-box cryptography in such a way to protect against DCA variants by obfuscating the round output with random masks. Specifically, we introduce a white-box AES (WB-AES) implementation applying the masking technique to the key-dependent intermediate value and the several outer-round outputs computed by partial bits of the key. Our analysis and experimental results show that the proposed WB-AES can protect against DCA variants including DCA with a 2-byte key guess, collision, and bucketing attacks. This work requires approximately 3.7 times the table size and 0.7 times the number of lookups compared to the previous masked WB-AES.